<!DOCTYPE html>

<!-- Disable auto scrollbars, to avoid an extra layout pass, which
     would hide the bug. The original fuzzer test instead used an
     insane margin on an atomic inline to make sure the scrollbars
     stayed put. -->
<style>body { overflow:scroll; }</style>

<p>PASS if no crash.</p>

<div id="rightFloat" style="float:right; height:40px;"></div>
<div style="float:left; height:300px;"></div>
<span>
    <div id="inlineBlock2" style="display:none; width:30px; height:300px;"></div>
    <span id="inline" style="display:none;">x</span>
</span>
<div>
    <div style="height:40px;"></div>
    <div style="display:table; writing-mode:vertical-lr;">
        <div>
            <div id="dummyBlock" style="display:none;"></div>
        </div>
        <div id="inlineBlock1" style="display:inline-block; width:30px; height:300px;"></div>
    </div>
</div>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
if (window.testRunner)
  testRunner.dumpAsText();
test(() => {
  document.body.offsetTop;
  document.getElementById("inlineBlock1").style.display = "none";
  document.getElementById("inlineBlock2").style.display = "inline-block";
  document.body.offsetTop;
  document.getElementById("rightFloat").style.display = "none";
  document.getElementById("dummyBlock").style.display = "block";
  document.body.offsetTop;
  document.getElementById("inline").style.display = "inline";
}, "no crash or assertion failure");
</script>
